Repository navigation
Reduce controller-runtime surface #3235
Description
Problem
Kagent still exposes controller-runtime clients and caches to application logic, creating overlapping access patterns and coupling reconciliation to manager internals.
Types read through both KRT and the manager client (Secrets, ConfigMaps, AgentTemplates, RemoteMCPServers, ...) are watched twice, and the two caches can disagree.
Direction
Align Kubernetes access with the kgateway apiclient pattern:
- Own an Istio
kube.Clientand generated clientsets behind the shared API client. - Use KRT/kclient for cached, watch-driven reads.
- Use generated typed clients for request-scoped CRUD.
- Limit controller-runtime to manager lifecycle, leader election, and integrations that require it.
Completion criteria
- Migrate affected controllers, including RemoteMCP reconciliation.
- Remove direct
GetClient()/GetCache()use and guard against regressions. - Add focused reconciliation coverage and document cache ownership.
References:
- kgateway commit kgateway-dev/kgateway@9c81ce6
- Drop usage of controller-runtime kgateway-dev/kgateway#12699, done in api/client: use kclient instead of controller-runtime kgateway-dev/kgateway#12710 and api/client: use apiclient.Client and kclient instead of controller-runtime kgateway-dev/kgateway#12853 (includes a forbidigo
^client.Client$guard)
Activity
[-]Epic: Reduce controller-runtime Kubernetes access in favor of Istio kube client and KRT[/-][+]Reduce controller-runtime Kubernetes access in favor of Istio kube client and KRT[/+][-]Reduce controller-runtime Kubernetes access in favor of Istio kube client and KRT[/-][+]Reduce controller-runtime surface[/+]Vaibhaav-Tiwari commentedon Oct 20, 2026
Hi @timflannagan, I'd like to help with this if you're open to splitting it up.
I mapped the current state on main (2261632).
go/core/pkg/app/app.gopassesmanager.GetClient()straight to 12 services (models, tools, prompts, system, schedules, sandboxes, and the kubecrud services for Agent, AgentTemplate, Harness and SandboxTemplate), plus the RemoteMCP discovery controller. 18 non-test files import controller-runtime'sclientorcachepackage.Following the kgateway commit, I'd propose doing it in stages:
GetClient()/GetCache()calls and document cache ownership.Would you like me to take this up? or are you already working on this?
timflannagan commentedon Nov 9, 2026
@Vaibhaav-Tiwari Apologies - sissed this notification. Agreed with the proposed stages here, but I think we'll want a maintainer to tackle this since there's more to unwind. I'll likely tackle most of this when I get background cycles
Vaibhaav-Tiwari commentedon Nov 9, 2026
No worries, thanks! makes sense. If a smaller piece of this comes up that you'd like to hand off, I'm happy to take it
cleanup: remove unused KubeClientWrapper (kagent-dev#3591)
chore(lint): forbid controller-runtime client outside tests (kagent-d…